Physical Domain Adversarial Attacks Against Source Printer Image Attribution

Deep learning networks are vulnerable to adversarial examples, subtle, human-imperceptible modifications that can deceive them. While most research has focused on digital adversarial attacks, in several applications it is necessary that the adversarial examples operate in the physical domain. Physical domain adversarial examples are usually crafted by requiring that the artefacts introduced by the attack survive the digital to analog and analog to digital transformations involved by such attacks. In this paper, we introduce an approach to generate adversarial examples against a source printer attribution system aiming at deciding which printer was used to print a given image document. With respect to conventional physical domain attacks, attacking a source printer attribution system poses additional challenges since the subtle features the attribution network relies on are introduced again during the Print and Scan (P&S) process that follows the attack, thus possibly nullifying the attack. We address this challenge by applying Expectation Over Transformation including within the pool of transformations a simulation of the P&S process relying on two GAN models trained for this aim. Experimental results demonstrate that our approach yields a significant increase of the attack success rates, surpassing those of baseline models.